Windows user profiles are designed to store a user's data and environmental settings while compartmentalizing and securing it against other users on the same system. This is done to simplify the user experience and maintain the customization of each user's workspace and ensure that data belonging to one user is inaccessible to anyone else save for that person.
But being part of the underlying system itself, it is no less prone to corruption, which can lead to data loss. This type of corruption is common since users interact with their desktop settings each time they log in until the moment they log out. The slightest issue could corrupt a system file used by the profile itself, more specifically, the portion of the profile that gets merged with the registry and acts as a table of contents for each user's personal profile.
SEE: System update policy template download (Tech Pro Research)
Most corruption will still allow users to access their data to some degree, but when the loss is catastrophic, all of the data that was stored in the affected profile is now removed from the system at once. Luckily for users, it isn't permanently lost—most of the time—just moved and stored in a hidden directory elsewhere until it is retrieved or purged. Knowing where to look allows IT the opportunity to recover lost data as you'll see below.
10 steps to data recovery
- Log off of any accounts on the system or reboot, if possible, to ensure that any threads are closed and any file locks are cleared from resident memory.
- Log in to the system with an admin-level account and one that is not linked to the account(s) experiencing data loss.
- Go to Control Panel | File Explorer Options, and a new window will open. From there, select the View tab, and select the radio button next to Show hidden files, folders, and drivers. Also, scroll down and uncheck the box next to Hide protected operating system files. Click OK to save the changes.
- With hidden files now disabled, search the root of the system drive (usually C:\) for a directory titled "Found.000". The prefix "found" will be included, however, depending on how many user accounts are affected by this corruption, the suffix ".000" may include other numbers or variations thereof. Note: I wholly recommend using WinDirStat, an open source utility, to map the drive's contents and break it down by occupied space, including the ability to search by file type. It makes the process of locating any data on a drive much simpler.
- By double-clicking these folders, it should reveal the contents of a user's profile folders, including common directories such as Photos, Documents, and Desktop, for example. These are the complete profiles for users affected by the corruption including all settings and configurations for applications.
- It is best practice to not move these files, but rather copy them to another location such as an external hard drive or network share. Keep in mind when copying to use a utility such as robocopy (which is built into Windows) that provides logging capability, including enumeration of files/folders and their respective file sizes to be able to compare to the source. This will ensure that all data is copied completely.
- Repeat steps 5-6 for each found directory until they've all been recovered.
- After successfully copying over the lost data, go to Control Panel | System, and click on the Advanced System Settings link to open those properties. Click on the Advanced tab and click on the Settings... button under the User Profiles section.
- This will open the user profiles window where the admin can delete any of the affected user profiles, clearing out the link to the profiles in the registry. Reboot the computer, once all corrupt profiles have been deleted.
- Upon reboot, have each of the affected users log back in to recreate their profile from scratch and have each one log back out. Once these profiles are created again, the admin may log back in and begin the process of restoring each user's data back to their newly created profiles, or simply provide them links to their data's location on a network share allowing them to download their content again.
Do note that while recent versions of Windows have made strides in allowing users to recover lost/corrupted data from a system, this information is presented to offer another method for user data recovery in the event that a proper back up does not exist or is not working. This method is still not an exact science though. Bearing that in mind, any recovery method is always second to a current back up of your data. Better yet, have two—in case the first back up isn't reliable.
- Data recovery do's and don't's for IT teams (TechRepublic)
- Windows 10 October update delete your files? This tool might recover them (ZDNet)
- How to get a free Windows (or Linux) recovery image for your OEM PC (ZDNet)
- Windows 10 tip: How to turn on System Protection and create System Restore points (ZDNet)
- 20 pro tips to make Windows 10 work the way you want (TechRepublic download)
- Microsoft Office 365 for business: Everything you need to know (ZDNet)
- It takes work to keep your data private online. These apps can help (CNET)
- Programming languages and developer career resources coverage (TechRepublic on Flipboard)
Jesus Vigo is a Network Administrator by day and owner of Mac|Jesus, LLC, specializing in Mac and Windows integration and providing solutions to small- and medium-size businesses. He brings 19 years of experience and multiple certifications from several vendors, including Apple and CompTIA.